org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J versions 1.7.26 later and in the 2.0.x series.

redhat RHSA-2018:1450: RHSA-2018:1450: Red Hat JBoss Enterprise Application Platform 6.4.20 security update (Important)

redhat RHSA-2018:0582: RHSA-2018:0582: rh-maven35-slf4j security update (Important)

The 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2021 CPU advisory.

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Coherence     Container). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to     compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of     Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).
    CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). (CVE-2021-35617)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services     (slf4j-ext)). The supported version that is affected is 12.1.3.0.0. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.
    Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base     Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). (CVE-2018-8088)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
    Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise     Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score     7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). (CVE-2021-35620)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 5.04, has slf4j packages installed that are affected by a vulnerability:

  - An XML deserialization vulnerability was discovered in     slf4j's EventData, which accepts an XML serialized     string and can lead to arbitrary code execution.
    (CVE-2018-8088)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for slf4j fixes the following security issue :

  - CVE-2018-8088: Remote attackers could have bypassed     intended access restrictions via crafted data. Disallow     EventData deserialization by default from now on     (bsc#1085970).

Security fix for CVE-2018-8088

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the slf4j package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The Simple Logging Facade for Java or (SLF4J) is     intended to serve as a simple facade for various     logging APIs allowing to the end-user to plug in the     desired implementation at deployment time. SLF4J also     allows for a gradual migration path away from Jakarta     Commons Logging (JCL).

  - Logging API implementations can either choose to     implement the SLF4J interfaces directly, e.g. NLOG4J or     SimpleLogger. Alternatively,it is possible (and rather     easy) to write SLF4J adapters for the given API     implementation, e.g. Log4jLoggerAdapter or     JDK14LoggerAdapter..

  - Security fix(es):

  - An XML deserialization vulnerability was discovered in     slf4j's EventData which accepts anXML serialized string     and can lead to arbitrary code     execution.(CVE-2018-8088)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for rhvm-appliance is now available for Red Hat Virtualization 4 for RHEL 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The RHV-M Virtual Appliance automates the process of installing and configuring the Red Hat Virtualization Manager. The appliance is available to download as an OVA file from the Customer Portal.

The following packages have been upgraded to a later upstream version:
rhvm-appliance (4.2). (BZ#1558801, BZ#1563545)

Security Fix(es) :

* python-paramiko: Authentication bypass in transport.py (CVE-2018-7750)

* slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution (CVE-2018-8088)

* undertow: Client can use bogus uri in Digest authentication (CVE-2017-12196)

* jackson-databind: unsafe deserialization due to incomplete blacklist (incomplete fix for CVE-2017-7525 and CVE-2017-17485) (CVE-2018-5968)

* ovirt-engine: account enumeration through login to web console (CVE-2018-1073)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Chris McCown for reporting CVE-2018-8088.
The CVE-2017-12196 issue was discovered by Jan Stourac (Red Hat).

Enhancement(s) :

* Previously, the default memory allotment for the RHV-M Virtual Appliance was always large enough to include support for user additions.

In this release, the RHV-M Virtual Appliance includes a swap partition that enables the memory to be increased when required. (BZ#1422982)

* Previously, the partitioning scheme for the RHV-M Virtual Appliance included two primary partitions, '/' and swap.

In this release, the disk partitioning scheme has been modified to match the scheme specified by NIST. The updated disk partitions are as follows :

/boot 1G (primary) /home 1G (lvm) /tmp 2G (lvm) /var 20G (lvm) /var/log 10G (lvm) /var/log/audit 1G (lvm) swap 8G (lvm) / 6G (primary) (BZ#1463853)

* Previously, the version tag was used as part of the RPM's naming scheme, for example, '4.1.timestamp', which created differences between the upstream and downstream versioning schemes. In this release, the downstream versioning scheme is aligned with the upstream scheme and the timestamp has moved from the version tag to the release tag. (BZ#1464486)

An update is now available for Red Hat JBoss Enterprise Application Platform 6.4 for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server.

This release of Red Hat JBoss Enterprise Application Platform 6.4.20 serves as a replacement for Red Hat JBoss Enterprise Application Platform 6.4.19, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.

Security Fix(es) :

* jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525) (CVE-2017-15095)

* jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095) (CVE-2017-17485)

* slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution (CVE-2018-8088)

* Apache ActiveMQ Artemis: Deserialization of untrusted input vulnerability (CVE-2016-4978)

* solr: Directory traversal via Index Replication HTTP API (CVE-2017-3163)

* tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources (CVE-2018-1304)

* jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries (CVE-2018-7489)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Liao Xinxi (NSFOCUS) for reporting CVE-2017-15095; 0c0c0f from 360Guan Xing Shi Yan Shi  for reporting CVE-2017-17485; and Chris McCown for reporting CVE-2018-8088.

An update is now available for Red Hat JBoss Enterprise Application Platform 6.4 for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server.

This release of Red Hat JBoss Enterprise Application Platform 6.4.20 serves as a replacement for Red Hat JBoss Enterprise Application Platform 6.4.19, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.

Security Fix(es) :

* jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525) (CVE-2017-15095)

* jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095) (CVE-2017-17485)

* slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution (CVE-2018-8088)

* Apache ActiveMQ Artemis: Deserialization of untrusted input vulnerability (CVE-2016-4978)

* solr: Directory traversal via Index Replication HTTP API (CVE-2017-3163)

* tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources (CVE-2018-1304)

* jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries (CVE-2018-7489)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Liao Xinxi (NSFOCUS) for reporting CVE-2017-15095; 0c0c0f from 360Guan Xing Shi Yan Shi  for reporting CVE-2017-17485; and Chris McCown for reporting CVE-2018-8088.

An update for jboss-ec2-eap is now available for Red Hat JBoss Enterprise Application Platform 6.4 for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The jboss-ec2-eap packages provide scripts for Red Hat JBoss Enterprise Application Platform running on the Amazon Web Services (AWS) Elastic Compute Cloud (EC2).

With this update, the jboss-ec2-eap package has been updated to ensure compatibility with Red Hat JBoss Enterprise Application Platform 6.4.19.

Security Fix(es) :

* jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525) (CVE-2017-15095)

* jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095) (CVE-2017-17485)

* slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution (CVE-2018-8088)

* Apache ActiveMQ Artemis: Deserialization of untrusted input vulnerability (CVE-2016-4978)

* solr: Directory traversal via Index Replication HTTP API (CVE-2017-3163)

* tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources (CVE-2018-1304)

* jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries (CVE-2018-7489)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Liao Xinxi (NSFOCUS) for reporting CVE-2017-15095; 0c0c0f from 360Guan Xing Shi Yan Shi  for reporting CVE-2017-17485; and Chris McCown for reporting CVE-2018-8088.

An update for eap7-jboss-ec2-eap is now available for Red Hat JBoss Enterprise Application Platform 7.1.2 for Red Hat Enterprise Linux 6 and Red Hat JBoss Enterprise Application Platform 7.1.2 for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The eap7-jboss-ec2-eap packages provide scripts for Red Hat JBoss Enterprise Application Platform running on the Amazon Web Services (AWS) Elastic Compute Cloud (EC2).

With this update, the eap7-jboss-ec2-eap package has been updated to ensure compatibility with Red Hat JBoss Enterprise Application Platform 7.1.2.

Refer to the JBoss Enterprise Application Platform 7.1 Release Notes, linked to in the References section, for information on the most significant bug fixes and enhancements included in this release.

Security Fix(es) :

* undertow: HTTP header injection using CRLF with UTF-8 Encoding (incomplete fix of CVE-2016-4993) (CVE-2018-1067)

* wildfly-undertow: undertow: Path traversal in ServletResourceManager class (CVE-2018-1047)

* slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution (CVE-2018-8088)

Red Hat would like to thank Ammarit Thongthua and Nattakit Intarasorn (Deloitte Thailand Pentest team) for reporting CVE-2018-1067, and Chris McCown for reporting CVE-2018-8088.

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Updated packages that provide Red Hat JBoss Enterprise Application Platform 7.1.2 and fix several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server.

This release of Red Hat JBoss Enterprise Application Platform 7.1.2 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.1.1, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.

Security Fix(es) :

* undertow: HTTP header injection using CRLF with UTF-8 Encoding (incomplete fix of CVE-2016-4993) (CVE-2018-1067)

* wildfly-undertow: undertow: Path traversal in ServletResourceManager class (CVE-2018-1047)

* slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution (CVE-2018-8088)

Red Hat would like to thank Ammarit Thongthua and Nattakit Intarasorn (Deloitte Thailand Pentest team) for reporting CVE-2018-1067, and Chris McCown for reporting CVE-2018-8088.

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Updated packages that provide Red Hat JBoss Enterprise Application Platform 7.1.2 and fix several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server.

This release of Red Hat JBoss Enterprise Application Platform 7.1.2 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.1.1, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.

Security Fix(es) :

* undertow: HTTP header injection using CRLF with UTF-8 Encoding (incomplete fix of CVE-2016-4993) (CVE-2018-1067)

* wildfly-undertow: undertow: Path traversal in ServletResourceManager class (CVE-2018-1047)

* slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution (CVE-2018-8088)

Red Hat would like to thank Ammarit Thongthua and Nattakit Intarasorn (Deloitte Thailand Pentest team) for reporting CVE-2018-1067, and Chris McCown for reporting CVE-2018-8088.

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution :

An XML deserialization vulnerability was discovered in slf4j's EventData which accepts anXML serialized string and can lead to arbitrary code execution. (CVE-2018-8088)

An update is now available for Red Hat JBoss Enterprise Application Platform 7.1 for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on WildFly.

This asynchronous patch is a security update for slf4j package in Red Hat JBoss Enterprise Application Platform 7.1.

Security Fix(es) :

* An XML deserialization vulnerability was discovered in slf4j's EventData which accepts xml serialized string and can lead to arbitrary code execution. (CVE-2018-8088)

The Simple Logging Facade for Java or (SLF4J) is a simple facade for various logging APIs allowing the end-user to plug in the desired implementation at deployment time. SLF4J also allows for a gradual migration path away from Jakarta Commons Logging (JCL).

Red Hat would like to thank Chris McCown for reporting CVE-2018-8088.

An update is now available for Red Hat JBoss Enterprise Application Platform 6.4 for Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server.

This asynchronous patch is a security update for slf4j package in Red Hat JBoss Enterprise Application Platform 6.4.

Security Fix(es) :

* An XML deserialization vulnerability was discovered in slf4j's EventData which accepts xml serialized string and can lead to arbitrary code execution. (CVE-2018-8088)

The Simple Logging Facade for Java or (SLF4J) is a simple facade for various logging APIs allowing the end-user to plug in the desired implementation at deployment time. SLF4J also allows for a gradual migration path away from Jakarta Commons Logging (JCL).

Red Hat would like to thank Chris McCown for reporting CVE-2018-8088.

An update for slf4j is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Simple Logging Facade for Java or (SLF4J) is a simple facade for various logging APIs allowing the end-user to plug in the desired implementation at deployment time. SLF4J also allows for a gradual migration path away from Jakarta Commons Logging (JCL).

Security Fix(es) :

* slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution (CVE-2018-8088)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Chris McCown for reporting this issue.

Security Fix(es) :

  - slf4j: Deserialisation vulnerability in EventData     constructor can allow for arbitrary code execution     (CVE-2018-8088)

From Red Hat Security Advisory 2018:0592 :

An update for slf4j is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Simple Logging Facade for Java or (SLF4J) is a simple facade for various logging APIs allowing the end-user to plug in the desired implementation at deployment time. SLF4J also allows for a gradual migration path away from Jakarta Commons Logging (JCL).

Security Fix(es) :

* slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution (CVE-2018-8088)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Chris McCown for reporting this issue.

ID	Name	Product	Family	Severity
154771	Oracle WebLogic Server Multiple Vulnerabilities (Oct 2021 CPU)	Nessus	Misc.	critical
127168	NewStart CGSL MAIN 5.04 : slf4j Vulnerability (NS-SA-2019-0015)	Nessus	NewStart CGSL Local Security Checks	critical
123184	openSUSE Security Update : slf4j (openSUSE-2019-423)	Nessus	SuSE Local Security Checks	critical
120593	Fedora 28 : slf4j (2018-8b0ad602be)	Nessus	Fedora Local Security Checks	critical
110735	EulerOS 2.0 SP3 : slf4j (EulerOS-SA-2018-1159)	Nessus	Huawei Local Security Checks	critical
110440	openSUSE Security Update : slf4j (openSUSE-2018-601)	Nessus	SuSE Local Security Checks	critical
109910	RHEL 7 : Virtualization (RHSA-2018:1525)	Nessus	Red Hat Local Security Checks	critical
109906	RHEL 6 : JBoss EAP (RHSA-2018:1449)	Nessus	Red Hat Local Security Checks	critical
109905	RHEL 7 : JBoss EAP (RHSA-2018:1448)	Nessus	Red Hat Local Security Checks	critical
109838	RHEL 6 : eap6-jboss-ec2-eap (RHSA-2018:1451)	Nessus	Red Hat Local Security Checks	critical
109491	EulerOS 2.0 SP2 : slf4j (EulerOS-SA-2018-1093)	Nessus	Huawei Local Security Checks	critical
109490	EulerOS 2.0 SP1 : slf4j (EulerOS-SA-2018-1092)	Nessus	Huawei Local Security Checks	critical
109390	RHEL 6 / 7 : JBoss EAP (RHSA-2018:1249)	Nessus	Red Hat Local Security Checks	critical
109389	RHEL 6 : JBoss EAP (RHSA-2018:1248)	Nessus	Red Hat Local Security Checks	critical
109388	RHEL 7 : JBoss EAP (RHSA-2018:1247)	Nessus	Red Hat Local Security Checks	critical
109181	Amazon Linux 2 : slf4j (ALAS-2018-999)	Nessus	Amazon Linux Local Security Checks	critical
108866	RHEL 6 / 7 : JBoss EAP (RHSA-2018:0628)	Nessus	Red Hat Local Security Checks	critical
108865	RHEL 6 / 7 : JBoss EAP (RHSA-2018:0627)	Nessus	Red Hat Local Security Checks	critical
108734	Fedora 26 : slf4j (2018-a46b358764)	Nessus	Fedora Local Security Checks	critical
108733	Fedora 27 : slf4j (2018-a4353f97db)	Nessus	Fedora Local Security Checks	critical
108660	CentOS 7 : slf4j (CESA-2018:0592)	Nessus	CentOS Local Security Checks	critical
108645	Scientific Linux Security Update : slf4j on SL7.x (noarch) (20180326)	Nessus	Scientific Linux Local Security Checks	critical
108644	RHEL 7 : slf4j (RHSA-2018:0592)	Nessus	Red Hat Local Security Checks	critical
108642	Oracle Linux 7 : slf4j (ELSA-2018-0592)	Nessus	Oracle Linux Local Security Checks	critical

Detections

Analytics

CVE-2018-8088

critical

Tenable Plugins

Coming Soon

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical